[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
; z/ a- F- Z5 d- o/ i( Q# n
Keyboard Interrupt Hook using I/O APIC

By: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
0 r" a0 z, H# a$ i  v4 f- Q6 ntested on the winXP, Pentium D Hyper-threading Enabled.


7 X6 L- w8 J3 @" _: E) F+ \; Z8 X. DSummary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
the interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.

- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
$ {: r* m1 L0 E1 H( x& z+ Dvector from the I/O APIC.
; U4 D. b/ N) j$ \1 ]
% w+ F( B' ?! i4 CFlow ::
: R" A) {; m1 V- L" H: X9 y
1. IRQ 1 Assert !!!
2. The I/O APIC receives the signal and refers the I/O Redirection table.
0 t/ X5 n7 b6 P2 L( F7 u& L9 y3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
( ?* T7 L% a% @5 i1 K' \5. A processor receives the signal.
6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
- ]5 I! K/ f2 l8. The processor Assert the second INTA signal.
5 J8 d  m; c" m9. The I/O APIC delivers the signal to the 8259a compatible PIC
2 E* }5 C* G, P7 ^" e/ Gfor ExtINT to its Delivery mode.
% h1 t+ L. a* t- @9 k5 D10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
12. our interrupt handler executed.
& ?/ w; ^( p4 g! D2 Q$ `
) T7 Q. A9 V( L* H- O: [
) a# t! \( f- o/ Lsourcecode and binary are available on the
9 [2 T3 g. b2 z6 D1 @- U5 zhttp://www.rootkit.com/vault/chpie/apic_keyboard.zip